Tag: Linux Forensics

All posts tagged with "Linux Forensics"

MACB Forensic Timestamp Reference I put together a nice little post here detailing the behavior of MACB timestamps (Modified, Accessed, Changed, …